4f59429fb16674587e462f66c5732b51d211df9bcce758eec5b31046f05a2d60

Analysis

max time kernel
28s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 16:41

Target

MatSploit.exe
Size

1.6MB
MD5

28bb98b32516829a00facf1232514479
SHA1

2c3fe53d4ddaa31bb09d3136ea8102697a0ebcf9
SHA256

6de25bc2a38be29578d61366fd5a789a58896dbe1c467f305f31e289d120e4a5
SHA512

8c121038c006039b057fe424d586647e732ee18f33526d7cee32b955666c0930ce6023cf45cfa2511a765f6c8a1fe0a6f5618bc9d88ae094ed86790edcd8a0ac
SSDEEP

49152:ySIgFm/3uuUX4ykWAfi313LfCzCcwSGO:HIgFmHUGaF3jecSGO

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

268 1232 WerFault.exe MatSploit.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MatSploit.exe

description pid process

Token: SeDebugPrivilege 1232 MatSploit.exe

pid	pid_target	process	target process
268	1232	WerFault.exe	MatSploit.exe

description	pid	process
Token: SeDebugPrivilege	1232	MatSploit.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

MatSploit.exe

description	pid	process	target process
PID 1232 wrote to memory of 268	1232	MatSploit.exe	WerFault.exe
PID 1232 wrote to memory of 268	1232	MatSploit.exe	WerFault.exe
PID 1232 wrote to memory of 268	1232	MatSploit.exe	WerFault.exe
PID 1232 wrote to memory of 268	1232	MatSploit.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\MatSploit.exe
"C:\Users\Admin\AppData\Local\Temp\MatSploit.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1568
  2⤵
  - Program crash
  PID:268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

memory/1232-54-0x0000000000190000-0x000000000032E000-memory.dmp

Filesize
1.6MB

Download
memory/1232-55-0x0000000007090000-0x00000000070D0000-memory.dmp

Filesize
256KB

Download
memory/1232-56-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/1232-57-0x00000000020B0000-0x00000000020B1000-memory.dmp

Filesize
4KB

Download
memory/1232-58-0x0000000007090000-0x00000000070D0000-memory.dmp

Filesize
256KB

Download